Bank of America has warned its customers about a recent data breach, revealing that their personal information was compromised due to a cybersecurity incident involving one of its service providers last year. The breach, disclosed to the Texas Attorney General on February 6, 2024, stemmed from unauthorized access to confidential data through a breach at Infosys McCamish Systems LLC (IMS).
The breach, which occurred around November 3, 2023, affected certain systems of IMS, prompting an investigation by the company and external data forensics specialists. Although Bank of America’s network remained secure, on November 24, 2023, IMS notified the bank about the potential compromise of data related to certain deferred compensation plans.
While the exact number of affected customers remains undisclosed by Bank of America, IMS, in a recent filing with the Attorney General of Maine, stated that 57,028 individuals had their data exposed in the breach. The compromised personally identifiable information (PII) includes names, addresses, Social Security numbers, dates of birth, and financial details such as account and credit card numbers.
Infosys, the parent company of IMS, is a multinational IT consulting firm with a significant global presence, employing over 300,000 individuals and serving clients in more than 56 countries. Bank of America, headquartered in Charlotte, North Carolina, is one of the largest banks in the United States, catering to approximately 69 million clients through various retail financial centers and ATMs across multiple countries and territories.
Following the breach, IMS conducted a thorough review to identify the compromised information and impacted consumers. Bank of America has initiated the process of notifying affected individuals and providing them with details of the compromised data. Despite the severity of the breach, Bank of America assured that its systems were not compromised during the incident.
The breach was attributed to a cyberattack, with the LockBit ransomware gang claiming responsibility for the attack on IMS. According to cybersecurity authorities, the LockBit ransomware operation, known for targeting high-profile organizations globally, has been associated with extorting millions of dollars from U.S. organizations through various cyberattacks since 2020.
A Bank of America spokesperson was unavailable for immediate comment, highlighting the ongoing investigation and response efforts following the data breach. The incident underscores the importance of robust cybersecurity measures and vigilance in safeguarding sensitive customer information in an increasingly digital environment.
